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Over the past two years the Audit Inspectorate has mounted a 
number of research projects on topics which were thought to 
be worthy of comparative study. This report deals with one 
such study and it is hoped that this publication will lead 
to consideration of the points which have emerged. 

This study has been directed by Mr R R Thackray IPFA, of the 
District Audit Service and carried out by Mr C S Wilmott 
MBCS of Peat Marwick Mitchell Consultants. 

The Audit Inspectorate wishes to acknowledge the considerable 
assistance afforded by the officers and members of the local 
authorities involved in the study and the field staff of the 
District Audit Service. 
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PART 1 



IMTRODUCTIOI TO THE METHODOLOGY 



Origins 

Reasons 

Purpose 

Elements 

Definitions 
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ORIGINS 



This document sets out a methodology for auditors to use when 
auditing the acquisition of computer facilities. 

It is concerned primarily with the procedures followed by any 
organisation for determining their policy and requirements for 
computer facilities in addition to being concerned with the 
implementation of decisions arrived at and taken in the process. 

The methodology was developed and tested in the field notably for 
the use of the external auditors for Local Government. It is 
thought to be equally suitable, however, for both internal and 
external auditors in the public and private sectors generally. 

REASONS 

Computer hardware and software is being introduced and used for 
administrative and accounting functions previously executed by 
clerical procedures. The acquisition of such facilities requires 
not only specialised knowledge on technical subjects but also a 
fresh approach to the analysis of problems and requirements 
leading to the production of solutions. It was felt that such 
was the impact of computerisation on the administrative processes 
of any organisation that traditional audit approaches were not 
appropriate or sufficient. 

The audit methodology reflects this situation with its emphasis 
on management and procedures. It also reflects the role of the 
auditor, which is not to report on whether the right equipment 
has been chosen (that is a function of management) but to report 
on the adequacy or otherwise of procedures and organisation. 
Adequacy is measured by whether or not a sound structure exists 
to promote an accurate analysis of the need for computer 
facilities and that procedures for evaluation and taking 
decisions are effective. 



PURPOSE 

The methodology seeks neither to produce answers nor a judgement 
on choice. Its purpose is: 

- to guide the auditor in the detail of matters to 
be addressed when conducting an acquisition audit; 

- to present these matters in an orderly manner; and 

- to provide a basis on which audit may advise 
organisations on the mechanics of computer 
acquisition . 
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ELEMENTS 



This document comprises a set of working papers for use by an 
auditor when auditing and reviewing the procedures for acquiring 
computing facilites. 

The document is in three parts viz: 

- a description of the methodology to be employed; 

- a series of audit work sheets which define the 
objectives and provide for recording the facts 
and findings of the audit; 

- schedules of matters, often of a technical nature, 
which are in the form of checklists for the auditor. 



Each part is divided into sections and where appropriate 
subsections, which are designed to be read independently and not 
read through sequentially as in an instruction manual. The 
intention of the methodology is for the auditor to use the work 
sheets and refer to other parts of the document as necessary. 

DEFINITIONS 

As stated earlier the methodology was developed for use by the 
internal and external auditors for local government in local 
authorities. Inevitably, therefore, the various terms and 
expressions used in this document relate specifically to local 
government. The principles set down in the methodology are 
thought to be equally valid however for other bodies in the 
public sector and also the private sector. There is, therefore, a 
need to clarify some of the terms used in the document for those 
in the private sector, central government and public utilities. 

The term authority” should be taken to mean any organisation 
which is a corporate body in the public sector such as a local 
authority or public utility, and in the private sector such as a 
commercial or industrial undertaking. 

The expression "the council" clearly refers to the elected 
members of a local authority but it should be construed as 
covering that body with the highest level of authority, in an 
organisation, with whom lies ultimate responsibility. In the 
private sector it means a board of directors or a group of 

partners and in a public utility or government department a board 
of management. 

A committee could of course comprise members who have a 
proprietory interest and also employers of the organisation. In 
the context of this document it is intended to cover those bodies 
to whom certain powers and responsibilities have been delegated 
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or have been charged with specific operational functions. 

"Members" and "officers" are terms used to distinguish between 
"proprietors" and employees of the organisation or between 
management and executive functions. 

There is a presumption that any organisation will follow standard 
procedures laid down to regulate the conduct of its business, 
such as the formation of bodies and committees and the conduct of 
their officers; the keeping of accounts and the letting of 
contracts. Such expressions as standing orders, financial 
regulations and minutes refer to such procedures and records of 
them. 
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PART 2 THE METHODOLOGY 



Objectives of the audit 
Timing of the audit 
Scope of the audit 
Conduct of the audit 
Audit documentation 
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OBJECTIVES 



The objective of the audit is to assess the adequacy of the 
procedures employed by an organisation when acquiring computer 
facilities. 

The objectives of the procedures should be to ensure that all 
computer facilities are acquired after due consideration; in 
accordance with an agreed policy; and that they meet the properly 
defined requirements of the organisation. 

The auditor seeks to decide whether the procedures are adequate 
or not in relation to the importance of the acquisition. 

Importance is measured in terms of: 

- cost; 

- time; 

- flexibility; and 

- impact. 

The greater the cost; or the longer the future commitment; or the 
more rigidly the organisation is committed to a single course of 
action; or the greater the impact of an acquisition on the staff 
of the organisation and working procedures, then the more 
thorough the procedures need to be for a given acquisition. 

The audit procedure defined in this methodology is concerned 
principally with computers for central data processing facilities 
in circumstances of first time procurement or replacement. It 
may also be used, however, for major enhancements to hardware and 
software . 

THE TIMING OF THE AUDIT 

Ordinarily the audit would be conducted after the event in which 
case the auditor is concerned with what has happened as an 
historical fact. Auditors are increasingly being consulted 
however by managers before the event. In such a case the auditor 
will be concerned with future intentions. The auditor will also 
be in a position to advise on the mechanics of computer 
acquisition though not the choice itself. 
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The audit may be divided into two stages: 

- a preliminary audit which by its nature will be fairly 
cursory though not superficial. Its purpose is to 
establish whether or not an extended audit is 
necessary. It is performed with the main audit 
objectives in mind, though it may well explore matters 
related to the organisation; the determination of the 
requirement; and the feasibility of solutions in some 
depth. It is conducted by audit managers and, or, 
experienced computer auditors. 

- an extended audit which is fairly detailed by nature. 
Its purpose is to investigate fully the thoroughness, 
quality and adequacy of the procedures for 
acquisition. It is performed with both main and 
detailed audit objectives in mind. Matters will be 
explored in depth particularly those related to 
shortlisting of suppliers, evalution of suppliers 
proposals, contracts and the obligations of suppliers 
and post implementation reviews. The audit is likely 
to be conducted by a computer auditor. 

THE SCOPE OF THE AUDIT 



In carrying out the audit the auditor will need to consider the 
following matters: 



- the structure of the organisation and process 
for taking decisions; 



- the feasibility of proposed solutions; 

” the specifications for facilities and 
shortlisting of suppliers; 



the evaluation of suppliers’ proposals; 

- contracts; 

- suppliers obligations; and 



- post implementation reviews. 
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THE CONDUCT OF THE AUDIT 



The way in which an audit will be conducted cannot be prescribed 
or even described as a procedure. Much will be determined by 
circumstances such as the size, structure and staffing of the 
organisation under review and the skills experience and time 
available to the auditor. 

Certain matters can, however, be stated. The auditor will need 
to establish facts in order initially to identify the procedures 
and then to make an assessment of them. The auditor will also 
wish to test for compliance with the procedures as well as to 
test for their effectiveness. In pursuit of these objectives 
the auditor will need to interview the appropriate individuals 
within the organisation; ask relevant questions; and refer to 
relevant documentation. In turn the auditor needs to assemble 
and record Information in a suitable form together with the 
results of any tests and his findings and observations. A 
suitable form is one that clearly relates the questions and 
answers to the audit objectives in such a way as to lead to an 
objective assessment of the adequacy of the procedures. 

In short a methodology that embraces standard questions and audit 
documentation can be employed to record facts and findings to 
produce and support an assessment of procedures and the results 
of an audit. Such a methodology is described in the following 
parts of this document which detail the standard forms of audit 
documentation; the audit objectives; and appropriate questions 
together with checklists of matters to which audit should address 
itself . 

AUDIT DOCUMENTATION 

In pursuit of the audit objectives the auditor should seek 
evidence that there are controlled procedures, that they are 
complied with and that they are effective in achieving their 
objective . 
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Before conducting the audit the auditor should gather relevant 
information which should include: 



- details of the organisation; 

- previous audit reports on acquisitions; 

- minutes of the proceedings of these bodies 
charged with the responsibility for 
considering and approving acquisitions. 

- reports and proposals prepared to support 
the case for such acquisitions; 

- invitations to tender, tenders and contract 
documents for the supply of computer facilities; 

- computer installation details; and 

- documents which define all the relevant procedures 
to be followed in the acquisition process. 

Such documentation should be filed and indexed on an audit work 
file together with details of interviews and meetings with 
individuals within the organisation. The indexing should permit 
easy cross reference to and from the audit worksheets. 



To arrive at the assessment of the adequacy of the procedures the 
auditor should complete the following audit control sheets: 

- Audit Control Sheet 



- Overall Appraisal Sheet 

- Weakness Appraisal Sheet 



- Audit Objectives Sheet 

i° assist in the process the auditor should refer as necessary to 
lart 1 the Methodology and to Part 3 the Audit Checklists. The 
end product of the audit process should be an audit report 

i'nd?v?Hnfi = he l 1 H ndlnS u S 0f fch8 audit and any discussions held with 

Hltdln che organisation and consequent or subsequent 

dSsagree^ent'if an y r ePOrt Sh ° Uld indicate "eas of agreement and 



aifandiTt ®l 0U l d 1 be 3U PP°rted by the completed Work Sheets and 
fc W0lk file suitably presented and cross referenced 
enable easy references to the relevant details that 
the opinions or findings expressed in the report. 



give rise 



to 

to 
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Audit Control Sheet 



The Audit Control Sheet should be completed when each stage of 
the methodology has been completed to the satisfaction of the 
audit manager. 

Overall Appraisal Sheet 

The Overall Appraisal Sheet summarises the auditors views about 
each aspect of the acquisition procedure. Eight main questions 
that the auditor must answer should be made. Single word 
comments are not acceptable. A ninth question invites general 
comments and may be answered at the discretion of the auditor. 
If substantial comments are to be made, supporting information 
should be recorded on the ninth Audit Objective Worksheet. 

Weakness Appraisal Sheet 

The ’Weakness Appraisal Sheet’ records the auditors view about 
particular weaknesses in the acquisition procedure. Issues 
should be described sufficiently to permit audit managers to take 
up matters with the appropriate senior members of the 
organisation. ' Weaknesses and other issues should be cross 
referenced to the ’Audit Objective Work Sheet’. Thus the 
’Weakness Appraisal Sheet’ is a working document for senior audit 
management to support any report in broad terms and from which 
reference to detail can be made as necessary. It also provides a 
control record that can be followed up or referred to at 
subsequent reviews. 

Audit Objective Worksheet 

This document records the auditor’s views about a particular 
aspect of the acquisition procedure. The main audit objective is 
stated at the top of each sheet. Detailed objectives are listed 
down the left hand side of the page. For further details on the 
matters which should be considered, the auditor is cross referred 
to the Audit Checklists. 

In using these Worksheets the auditor seeks to establish whether 
there is a controlled procedure and if so whether it is followed. 
Facts about the former are recorded in the column headed 
"PROCEDURES". Comments on the latter are made in the column 
headed "AUDIT CONFIRMATION OF PROCEDURES’. 

The column headed ’Cont’n sheet cross ref’ shuld contain 
reference to any additional papers where facsts about the 
acqusition procedure are recorded. 
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The column headed ’initials and schedule reference’ should 
contain : 



- the initials of the auditor who investigates 
whether the control procedures are applied; 

- reference to the documents studied in the 
course of these investigations. 

The column headed 'Weakness Appraisal Sheet Cross Reference’ 
should contain reference to the weakness appraisal sheet, whereon 
issues that should be pursued may be more fully described. 

There are nine main objective sheets. Use of the first eight is 
mandatory in that all the audit objectives shown thereon must be 
pursued by the auditor. The ninth blank sheet is to be used at 
the auditor’s discretion when additional lines of enquiry are 
relevant at a particular audit. In such an event it should record 
the audit objectives that the auditor wishes to pursue. They 
should be approved by the audit manager at the outset of the 
review . 



THE AUDIT CHECKLISTS 

The ’Audit Checklists’ detail specific matters to be checked by 
the auditor. Each section of the checklists corresponds to an 
’Audit Objective Worksheet’ both at the level of main objectives 
and also at the level of detailed objectives. The more 
experienced auditor may use the check lists only as an aide 
raemoire. The less experienced auditor may use them to identify 
the subjects that have to be addressed and also researched and 
considered before using the Audit Worksheet. The checklists are 
supported by appendices of a technical and more detailed nature 
appropriate to particular audit objectives. 

The purpose of the Checklists and appendices is to provide 
amplification of the main and detailed objectives so as to give 
the auditor a clear understanding of the nature of the questions 
posed and the answers he may expect. 
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PART 3 THE AUDIT WORKSHEETS & CHECKLISTS 



The Audit Control Sheet 
The Overall Appraisal Sheet 
The Weakness Appraisal Sheet 
The Audit Objective Worksheets 
The Audit Checklists 
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COMPUTER FACILITY ACQUISITION 
AUDIT CONTROL SHEET 

Organisation: 



AUDIT REPORT 

*T- , . - — ■ — 

OVERALL APPRAISAL 

WEAKNESS APPRAISAL 

AUDIT WORKSHEET 

AUDIT WORKFILE & DOCUMENTATION 



Audit 



Initials 



Signature of Audit Manager: 
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date : 



Date 



Date 



COMPUTER FACILITY ACQUISITION 
OVERALL APPRAISAL SHEET 



Organisation : Audit Date: 

Record your views on the following: 



1. How good are the procedures for deciding who should be 
involved and when ? 



2. How good are the procedures for establishing why the 
acquisition of computer facilities needs to be considered ? 



3. How good are the procedures for approving the feasibility 
study ? 



4, How good are the procedures for shortlisting those 
organisations ' capable of supplying the desired computer 
facilities ? 



5. How good are the procedures for selecting the supplier best 
suited to the organisation’s needs ? 



6. How good are the procedures for checking the acceptability of 
contracts ? 



7. How good are the procedures for checking that suppliers have 
met their obligations ? 



8. How good are the procedures for post-implementation review ? 



Are there any general comments you wish to make ? 



Signature of auditor: 



Date 
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COMPUTER FACILITIES ACQUISITION 



WEAKNESS APPRAISAL SHEET 
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THE AUDIT OBJECTIVE WORKSHEETS 
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MAIN OBJECTIVE: 1. THERE ARE ADEQUATE PROCEDURES FOR 

DECIDING WHO SHOULD BE INVOLVED AND WHEN 



CHECKLIST CROSS 
REFERENCE; SECTION 1 



DETAILED AUDIT OBJECTIVE 


RELATED PROCEDURES 


Cont'n. 
sheet 
cross ref. 


Checklist 
cross, ref. 


AUDIT CONFIRMATION OF PROCEDURES 


Weakness 
appraisal sheet 
cross reference 


Initials and 
schedule 
reference 


The decisions required during the 
acquisition procedure are defined, 
and the people to be involved are 
identified. 






1.1 








Staff have the right experience 
and are available to conduct the 
acquisition process. 






1.2 








Inter-relationships between 
committees and individuals with 
acquisition responsibilities are 
defined. 






1.3 








The decision makers co-ordinate 
computer plans and policies. 






1.4 








Terms of reference and 
responsibilities are defined for the 
acquisition process. 






1.5 
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MAIN OBJECTIVE: 2. THERE ARE ADEQUATE PROCEDURES FOR ESTABLISHING WHY THE 

ACQUISITION OF COMPUTER FACILITIES NEEDS TO BE CONSIDERED 



CHECKLIST CROSS 
REFERENCE: SECTION 2 



DETAILED AUDIT OBJECTIVE 


RELATED PROCEDURES 


Cont'n. 
sheet 
cross ref. 


Checklist 
cross, ref. 


AUDIT CONFIRMATION OF PROCEDURES 


Weakness 
appraisal sheet 
cross reference 


Initials and 
schedule 
reference 


The problem is defined. 






2.1 . 








Assumptions about the seriousness 
of the problem are defined. 






2.2 








Alternative solutions to the 
problem are identified. 






2.3, 








The alternative which gives the best 
chance of resolving the problem is 
identified. 






2.4 








Approval to proceed with the study 
of computer facility acquisition 
is obtained. 






2.5 
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MAIN OBJECTIVE: 3. THERE ARE ADEQUATE PROCEDURES FOR 

APPROVING THE FEASIBILITY STUDY 



CHECKLIST CROSS 
REFERENCE: SECTION 3 



DETAILED AUDIT OBJECTIVE 


RELATED PROCEDURES 


Cont'n. 
sheet 
cross ref. 


Checklist 
cross; ref. 


AUDIT CONFIRMATION OF PROCEDURES 


Weakness 
appraisal sheet 
cross reference 


Initials and 
schedule 
reference 


The objectives and benefits are 
defined. 






3.1 








The life cycle costs of the proposed 
acquisition are defined. 






3.2 








The priorities for computer 
development are identified. 






3.3 








Approval to proceed is obtained. 






3.4 
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MAIN OBJECTIVE: 4. THERE ARE ADEQUATE PROCEDURES FOR SHORTLISTING THOSE 

ORGANISATIONS CAPABLE OF SUPPLYING THE DESIRED COMPUTER FACILITIES 



CHECKLIST CROSS 
REFERENCE: SECTION 4 











DETAILED AUDIT OBJECTIVE 


RELATED PROCEDURES 


Cont'n. 
sheet 
cross ref. 


Checklist 
cross, ref. 


AUDIT CONFIRMATION OF PROCEDURES 


Weakness 
appraisal sheet 
cross reference 


Initials and 
schedule 
reference 


There is a definition of the 
computer facilities- to be supplied. 






4.1 








There is a declaration of the 
conditions under which suppliers 
are. to tender. 






4.2 








Sources of supply are researched. 






4.3 








There is an initial selection process 
to establish a shortlist. 






4.4 




• 




Approval of the shortlist is 
obtained. 






4.5 
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MAIN OBJECTIVE: 5. THERE ARE ADEQUATE PROCEDURES FOR SELECTING 

THE SUPPLIER BEST SUITED TO THE AUTHORITY'S NEEDS 



CHECKLIST CROSS 
REFERENCE: SECTION 5 



DETAILED AUDIT OBJECTIVE 


RELATED PROCEDURES 


Cont'n. 
sheet 
cross ref. 


Checklist 
cross, ref. 


AUDIT CONFIRMATION OF PROCEDURES 


Weakness 
appraisal sheet 
cross reference 


Initials and 
schedule 
reference 


There are technical and financial 
evaluations. 






5.1 








There are procedures for answering 
queries on proposals and for 
recording understandings that may be 
reached during discussions. 






5.2 








The technical evaluation techniques 
are appropriate and are defined in 
detail. 






5.3 








The evaluation is conducted on a 
fair and reasonable basis. 






5.4 








Approval is obtained for the 
reconsnended course of action. 






5.5 
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MAIN OBJECTIVE: 6. THERE ARE ADEQUATE PROCEDURES FOR CHECKING 

THE ACCEPTABILITY OF CONTRACTS 



CHECKLIST CROSS 
REFERENCE! SECTION 6 



DETAILED AUDIT OBJECTIVE 


RELATED PROCEDURES 


Cont'n. 
sheet 
cross ref. 


Checklist 
cross, ref. 


AUDIT CONFIRMATION OF PROCEDURES 


Weakness 
appraisal sheet 
cross reference 


Initials and 
schedule 
reference ' 


The details of the contracts are 
scrutinised by suitably qualified 
staff. 






6.1 








The conditions for acceptance of the 
contracts are defined. 






6.2 








The contracts reflect the agreements 
that were reached during the 
acquisition process. 






6.3 








The contracts are secured in the best 
interests of the authority. 






6.4 








Approval to sign contracts is 
obtained. 






6.5 
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MAIN OBJECTIVE: 7. THERE ARE ADEQUATE PROCEDURES FOR CHECKING THAT 

SUPPLIERS HAVE MET THEIR OBLIGATIONS 



CHECKLIST CROSS 
REFERENCE: SECTION 7 



DETAILED AUDIT OBJECTIVE 


RELATED PROCEDURES 


Cont'n, 
sheet 
cross ref. 


Checklist 
cross, ref. 


AUDIT CONFIRMATION OF PROCEDURES 


Weakness 
appraisal sheet 
Cross reference 


Initials and 
schedule 
reference 


Delivery schedules are met. 






7.1 








Suppliers only deliver that which 
was ordered. 






7.2 








What is delivered is acceptance 
tested before being put into use. 






7.3 








Payment is only made for what has 
been accepted. 






7.4 








Maintenance is adequately carried 
out. 






7.5 























Printed image digitised by the University of Southampton Library Digitisation Unit 



MAIN OBJECTIVE: 8. THERE IS A POST 

IMPLEMENTATION REVIEW 



CHECKLIST CROSS 
REFERENCE! SECTION 8 



DETAILED AUDIT OBJECTIVE 


RELATED PROCEDURES 


Cont'n. 
sheet 
cross ref. 


Checklist 
cross, ref. 


AUDIT CONFIRMATION OF PROCEDURES 


Weakness 
appraisal sheet 
cross reference 


Initials and 
schedule 
reference 


There is a review of the objectives 
that the acquisition set out to meet. 






CO 








There is a review of the extent 
to which these objectives were 
accomplished. 






8.2 
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MAIN OBJECTIVE: 



DETAILED AUDIT OBJECTIVE 


RELATED PROCEDURES 


Cont'n. 
sheet 
cross ref. 


Checklist 
cross, ref. 


AUDIT CONFIRMATION OF PROCEDURES 


Weakness 

appraisal sheet 
cross reference 


Initials and 
schedule 
reference 
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THE AUDIT CHECKLISTS & TECHNICAL APPENDICES 



For use by the auditor when completing 
the Audit Objectives Worksheets 



1. ORGANISATIONAL MATTERS 

1 . 1 Definition of the decision making process 

1.2 Availability of skills 

1 . 3 Organisation 

1.4 Co-ordination 

1.5 Terms of reference 

2. ESTABLISHMENT OF THE NEED FOR CHANGE 

2.1 Definition of the problem 

2.2 Assumptions 

2.3 Alternatives 

2.4 Evaluation 

2.5 Approval 

3. FEASIBILITY 

3.1 Objectives & benefits 

3.2 Costs 

3.3 Priorities 

3.4 Approval 

4 SELECTION: SHORTLISTING OF SUPPLIERS 

4.1 Definition of what is to be supplied 

4.2 Conditions of tender 

4.3 Research 

4.4 Shortlisting 

4.5 Approval 

5 SELECTION: EVALUATION OF PROPOSALS 
5 . 1 Structure 

5.2 Additional information 

5.3 Technical evaluation techniques 

5.4 Conduct of the evaluation 

5.5 Approval 

6 CONTRACTS 

6.1 Scrutiny of the contracts 

6.2 Conditions for acceptance 

6.3 Verification 

6.4 Implications 

6.5 Approval 

7 OBLIGATIONS OF THE SUPPLIER 

7 . 1 Schedules 

7.2 Delivery 

7*3 Acceptance testing 

7.4 Payment of invoices 

7.5 Maintenance 
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I 

II 

III 

IV 

V 

VI 

VII 

VIII 

IX 

X 

XI 

XII 

XIII 

XIV 

XV 

XVI 

XVII 

XVIII 

XIX 



POST IMPLEMENTATION REVIEW 

8 . 1 Objectives 

8.2 Accomplishments 

APPENDICES 

Hardware specification checklist 
Systems software specification checklist 
Application software specification checklist 
Computer site specification checklist 
Support specification checklist 

Harware information checklist 
System software information checklist 
Application software information checklist 
Computer site information checklist 
Support information checklist 

Rental information checklist 
Purchase information checklist 
Lease information checklist 

Standard checks on contract terms & conditions 
Particular checks on contracts for hardware 

Particular checks on contracts for software 

& software licences 

Particular checks on contracts for computer 

site construction 

Particular checks on contracts for 

the provision of staff 
Particular checks on joint agreements 
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1 . 



ORGANISATIONAL MATTERS 



This is concerned with the: 

- definition of the decisions to be taken during acquisition 
and who is to take them, 

availability of skills to advise on these decisions, 
organisation of the decision making process, 
co-ordination of computer plans, 

allocation of terms of reference and responsibilities . 

Audit evidence should be sought in management correspondence, 
standing orders, financial regulations, internal audit reports, committee 
terms of reference and committee minutes . 

1 . 1 Definition of the decision making process 

Matters which should be considered are the: 
role of members in: 

budgetting for computer facilities, 
acquisition decisions, 
role of officers in: 

promoting the case for acquisition, 

- promoting their application areas, 
specifying their requirements, 
participating in the acquisition process, 
role of management services in: 

co-ordinating with computer plans, 
role of computer management in: 

managing the computer resources, 
advising on the potential of the computer, 
day to day operation of the computer, 
long term planning. 
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timing of decisions about: 

whether there is a need to change, 
whether acquisition is feasible, 
which suppliers are shortlisted, 
which supplier is best for the authority, 
whether contracts are acceptable, 
whether suppliers have met their obligations, 
whether the acquisition was successful, 
requirement, if any, for consultation with: 
unions , 

internal audit, 
district audit, 
approved auditors . 

control over the premature involvement of the suppliers . 

1 * 2 Availability of skills 

Hatters which should be considered are the: 

availability and qualifications of people to advise on 
acquisition from within the authority, 

availability and qualifications of people from external 
organisations who may advise on acquisition, 
allocation of responsibilities to senior staff, 
experience of other authorities, 

timing of the appointment of the computer manager. 

1.3 Organisation 

Matters which should be considered are the: 

existence of members' and officers' committees, 
creation of new members’ and officers' committees, 



Printed image digitised by the University of Southampton Library Digitisation Unit 



chair persons, 

representation of interested parties, 
timing of meetings. 

1.4 Co-ordination 

Matters which should be considered are the: 
avoidance of confusion about the: 

relative priority of user requests for computer 
facilities , 

timescale for computer planning, 
plans for central hardware and software, 
technical and financial evaluation of supplier 
proposals , 

respective roles of mainframes, mini’s, micro’s and 
word processors within the authority. 

1.5 Terms of reference and responsibilities 
Matters which should be considered are the: 

delegated powers for: 

setting computer expenditure budgets , 
approving short and long term plans, 

- approving the major acquisition decisions, 

examining and approving the technical aspects of 
acquisition, 

examining and approving the financial aspects of 
acquisition, 

examining and approving the areas where computer 
techniques should be applied. 
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instructions given about: 
preparing reports, 
presenting reports to committees. 
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2 . 



ESTABLISHMENT OF THE NEED FOR CHANGE 



This is concerned with the: 

definition of the problem, 
declaration of any assumptions, 

consideration of the alternatives to computer acquisition, 
consideration of the costs of conducting a feasibility 
study, 

approval to proceed. 

Audit evidence should be sought in management correspondence, 
internal audit reports and reports to committees. 

2 . 1 Definition of the problem 

Matters which should be considered are the: 
quantification of the problem, 

determination of its cause, effect and consequences. 

2 . 2 Assumptions 

Matters which should be considered are the: 
effect of doing nothing, 
effect of deferment. 

2 . 3 Alternatives 

Matters which should be considered are the: 

improvement of the performance of clerical systems , 
improvement of the performance of any existing computer 
equipment , 

alternative to centralised computer facilities. 

2 - 4 Evaluation 

Matters which should be considered are the: 

strengths and weaknesses of each alternative course of 
action, 
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time, money and resources needed to reduce operational 
and maintenance costs on any existing computer 
facilities , 

time, money and resources needed to study computer 
acquisition, 

ability of computer acquisition to solve the problem. 

2.5 Approval 

Matters which should be considered are the: 

approval of the terms of reference and costs of the 
recommended course of action, 

compatibility of the recommended course of action with 
the overall computer processing strategy, 
co-ordination of the recommended course of action with 
other actual or potential areas of study, 
consideration of the requirements of other projects, 
their relative benefits and the resources available for 
their execution. 
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FEASIBILITY 



This is concerned with the: 

steps taken to ensure that computer acquisition is approved 
only if likely to produce desirable benefits, 
steps taken to ensure that the costs of computer processing 
are determined approximately before any commitment to 
acquisition is made, 

identification of short and long range objectives, 

- approval to proceed. 

Audit evidence should be sought in management correspondence, 
iternal audit reports , reports to committees and committee minutes . 

1 Objectives and benefits 

Hatters which should be considered are the: 

functions to be performed by the acquisition, 
quality of the services to be provided by the acquisition, 
information to be processed by the acquisition, 
assumptions about future: 
staffing levels , 
user department locations, 
volumes of work. 

* 2 Costs 

Hatters which should be considered are the: 

total cost of the acquisition throughout its life cycle, 
meaning: 

selection costs, 

installation, commissioning and conversion costs, 
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operating costs, including allowance for losses due 
to failure to achieve the specified objectives, 
maintenance costs, 

disposal costs, including those for any existing 
computer facilities and also the proposed acquisition, 
definition of life cycle costing objectives, including: 
the required timescale over which the costing is to 
apply, 

the computer strategy that is to be costed in terms 
of hardware, software, site and implementation 
assistance plans, 

the computer department organisation that is to be 
costed, in terms of operations and development 
personnel, and also in terms of the types of people, 
levels of skill and sources from which they will be 
obtained, 

the key assumptions which are to be made, 
forecasting of life cycle value and costs, including: 
the most likely outcome, 

a forecast based on optimistic assumptions, 
a more pessimistic forecast, 
speculation of different acquisition strategies and the 
matching of the chosen approach to the objectives and 
benefits to be achieved, 

costing of alternative acquisition strategies and the 
consideration of: 

discounted cash flow projections, 
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inflation, 

capital costs, financing costs, treatment of taxes 
or duties, operating and maintenance cost, 
maintenance characteristics , incidence and duration 
of preventive and breakdown maintenance, special 
skills, components and spares, 

reliability attributes in terms of quality, resilience 
and speed, and the incidence and duration of down 
time, the mean time between failure and the mean 
time to repair, 

flexibility of the proposed acquisition to meet 
changes in demand for computer services in size , 
quality and quantity, 

obsolescence and the cost of carrying capacity in 
excess of requirements. 

evaluation of alternative computer strategies and the 
possibilities for optimising life cycle costs including 
studies of the trade-off between: 

acquisition reliability and cost, 
acquisition resilience and cost, 

acquisition life span and capital and revenue cost. 

3 . 3 Priorities 

Matters which should be considered are the: 
essential user requirements, 
desirable user requirements, 

computer facilities which will have the earliest beneficial 
effect on the authority. 
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3.4 Approval 

Matters which should he considered are the: 

approval of the feasibility study evaluation, 

approval of the return on investment, 

fairness and reasonableness of the feasibility study 

evaluation. 
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4 . 



SELECTION: SHORTLISTING OF SUPPLIERS 



This is concerned with the: 

definition of the computer facilities to be supplied, 

conditions of tender, 

research of the sources of supply, 

shortlisting of suppliers , 

approval of the shortlist. 

Audit evidence should be sought in management correspondence, 
standing orders, financial regulations, internal audit reports, supplier 
correspondence, reports to committees, committee minutes, minutes of 
meetings with suppliers and invitation to tender documentation. 

4 . 1 Definition of what is to be supplied 

Hatters which should be considered are the: 
specification of the hardware that is 

to be supplied, (see also Appendix I) 

specification of the system software 

that is to be supplied, (see also Appendix II) 

specification of the application software 
that is to be supplied, (see also Appendix III) 

specification of the computer site 

that is to be constructed, (see also Appendix IV) 

specification of the support that is 

to be supplied, (see also Appendix V) 

incorporation of other authority requirements 
in circumstances of joint venture. 
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4 . 2 Conditions of tender 

This is concerned with the: 

initial contact with the suppliers , 
invitation to tender. 

4.2.1 Initial contact 

Hatters which should be considered are the: 

formal invitation to participate that is issued to suppliers , 
timescales and deadlines for the tender, 
notice given to suppliers about the: 

criteria on which their proposals will be judged, 
evaluation techniques that will be used in judging 
their proposals, 

non admission of extra costs over and above the 
tender . 

suppliers' confirmation at the outset that they are 
prepared to bid on the prescribed basis, 
person in the authority to whom the suppliers should 
direct themselves on matters directly or indirectly 
related to the submission of tenders, 

steps taken to advise suppliers of any standard terms of 
contract, 

conditions under which standing terms of contract may be 
varied . 

4.2.2 Invitation to tender 

Matters which should be considered are the: 
arrangements for: 

submitting tenders , 
opening tenders, 
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withdrawing tenders partially or in total, 
answering suppliers’ questions, 
answering the authority's questions. 



confidentiality pledges requested of suppliers whether or 
not they submit a proposal, 

rights reserved by the authority to reject proposals 
and/or not to accept the lowest of any tender, 
authority disclaimers for any liability for any costs 
incurred by suppliers in the preparation of their response 
to the invitation to tender, 

questions which suppliers are instructed to answer about 
their products. See also: 



Appendix VI : 


hardware information checklist, 


Appendix VII : 


system software information 



checklist, 



Appendix VIII : 


application software information 



checklist, 



Appendix IX : 


computer site information checklist, 


Appendix X : 


support information checklist. 


standards set for the 


format of suppliers 1 replies, 



steps taken to ensure that competitive suppliers all set 
out to solve the same problem and that this problem 
remains as defined when establishing the need for change, 
arrangements for providing suppliers access to information, 
requirement for a supplier to declare details of any 
sub-contracts that he intends to employ. 
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4.3 



Research 



Matters which should be considered are the: 
consultation of guides and directories, 
reference to other organisations and authorities , 
supply of hardware from: 

computer manufacturers, 
software houses, 
supply of software from: 

computer manufacturers, 
software houses. 

building, environmental and electrical services available 
within the authority, 
supply of staff from: 

computer manufacturers , 
software houses, 
consultancies, 
contract staff agencies. 

4.4 Shortlisting 

Matters which should be considered are the: 

mandatory requirements that must be met by suppliers, 
desirable requirements that hopefully can be met by 
suppliers , 

requirements which require some form of performance 
measurement to establish whether they are met, 
requirements which do not require performance measurement 
to establish whether they are met, 
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mandatory requirements that do not require measurement 
and suppliers’ confirmation at the outset that they meet 
these requirements and that they have the capability to 
satisfy the other criteria, 
control over undue pressure to: 
buy British, 

buy from the local major employer, 
not engage in competitive tender. 

4.5 Approval 

Matters which should be considered are the: 

approvals sought of, and given to the shortlist, 
composition of the evaluation team, 

- approvals sought of, and given to the invitation to 
tender document, 

acknowledgments from suppliers of their receipt of the 
invitation to tender. 
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5. 



SELECTION: EVALUATION OF PROPOSALS 



This is concerned with the: 

structure of the evaluation, 

provision of specification and tender information in 

addition to that previously published, 

technical evaluation techniques , 

conduct of the evaluation, 

approval of the choice. 

Audit evidence should be sought in management correspondence, 
internal audit reports, supplier correspondence, reports to committees, 
committee minutes , minutes of meetings with suppliers and supplier 
tender documentation. 

5 . 1 Structure 

This is concerned with the: 
technical evaluation, 
financial evaluation. 

5.1.1 Technical evaluation 

Matters which should be considered are the: 

evaluation of the extent to which suppliers proposals 
fall short of, meet or exceed the specified requirement 
for : 

hardware, 
system software, 
application software, 
computer site, 
support assistance. 

demonstration that the proposed equipment and/or services 
will work successfully. 
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5 . 1.2 



Financial evaluation 



Hatters which should be considered are the: 
methods of funding the acquisition: 

rental, (see also Appendix XI) 

purchase, (see also Appendix XII) 

lease. (see also Appendix XIII) 

identification of all the once off and recurring annual 
costs, including those for: 

hardware, including post office lines, 

system software, 

application software, 

site preparation, 

support, 

delivery, including transport to the kerbside, 
installation, including the location of equipment at 
the site prepared by the authority, 
commissioning, 

consumables, including paper, cards, paper tape and 
magnetic media, 

- insurance , 

miscellaneous equipment, including off line machinery, 

cleaning equipment, fire fighting devices, 

staff, including recruitment and salaries, 

conversion, 

maintenance. 

life cycle costs as now known compared to those anticipated 
by the feasibility study, 

circumstances that require a re-evaluation of cost/ 
benefit. 
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5.2 



Additional information 



Matters which should he considered are the: 

documentation of addenda to the invitation to tender, 
documentation of addenda to the suppliers’ proposals, 
access to any additional information afforded to competitive 
suppliers . 

5 . 3 Technical evaluation techniques 

This is concerned with the: 

weighted ranking procedure, 
cost value procedure, 
benchmark procedure, 
strength and weakness analysis. 

5.3.1 Weighted rankings 

Matters which should be considered if this technique is used, 

are the: 

importance of each requirement criterion relative to the 
others , 

range of possible situations that must be valued for each 
criterion, ranging from what is minimally acceptable to 
what is most desirable, 

minimum score that suppliers must accumulate to remain in 
contention , 

minimum amount by which a supplier’s score must exceed 
that of his nearest competitor in order to be considered 
superior, 
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5.3.2 



Cost value 



Hatters which should be considered if this technique is used, 

are the: 

sterling values to be placed on each criterion, 

minimum value that suppliers must accumulate to remain in 

contention, 

minimum amount by which a supplier’s cost value must 
exceed that of his nearest competitor in order to be 
considered superior. 

5.3.3 Benchmarks 

Hatters which should be considered if this technique is used, 

a re the : 

performance criteria that are to be met, 

circumstances that should exist when these criteria are 

met, 

responsibilities for preparing, running and reporting on 
the benchmark, 

- responsibilities for ensuring fair and reasonable conduct 
of the benchmark, 

conduct of a benchmark or the use of other organisations’ 
benchmark reports as a yardstick. 

5.3.4 Strength and weakness analysis 

Matters which should be considered if this technique is used, 

are the: 

particular strengths of a supplier’s proposal, 
particular weaknesses of a supplier's proposal. 



Printed image digitised by the University of Southampton Library Digitisation Unit 



5.4 



Conduct of the evaluation 



Matters which should be considered are the: 

relevance of visits made to supplier premises and 
reference sites, 

restrictions placed on contact between suppliers and 
members of the authority outside of the evaluation team, 
presentations made by suppliers to authority members and 
officers , 

presentations made by suppliers to members of the 
evaluation team, 

restrictions placed on members of the evaluation team 
with respect to the confidentiality of their appraisals, 
separation of those involved in determining what the 
evaluation criteria will be from those involved in judging 
whether these criteria are met, 
steps taken to resolve disputes, 

equal handling of suppliers with competitive products , 
validation of supplier claims, 

validation of assumptions made during the evaluation. 

5 .5 Approval 

Matters which should be considered are the: 

approvals sought of, and given to the technical 
evaluations , 

approvals sought of, and given to the financial 
evaluations , 

prior knowledge in the approving bodies that computer 
acquisition is being considered. 
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CONTRACTS 



6 . 

This is concerned with the: 

scrutiny of the contracts, 

conditions for acceptance of the contracts , 
contract accuracy, 
authority interests , 
approval to sign. 

Audit evidence should be sought in management correspondence, 
internal audit reports, supplier correspondence, reports to committees, 
committee minutes, minutes of meetings with suppliers and contractual 
documents . 

6. 1 Scrutiny of the contracts 

Hatters which should be considered are the: 
standard checks on contract terms 

and conditions, (see Appendix XIV) 

particular checks on contracts for the: 



— 


hardware , 


(see Appendix XV) 


- 


software , 


(see Appendix XVI) 


- 


computer site, 


(see Appendix XVII) 


- 


support staff. 


(see Appendix XVIII) 



particular checks on joint authority 

agreements. (see Appendix XIX) 

6 . 2 Conditions for acceptance 

Matters which should be considered are the: 

agreement of conditions for acceptance of the contracts, 

negotiation of counter offers, 

formal statement of the contract price, 

information on the way in which invoices should be submitted, 
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request for formal acknowledgment, confirmation that work 
is being put in hand and the name of the person to whom 
all future correspondence should be addressed, 
agreement to the programme of work. 

6 . 3 Verification 

Matters which should be considered are the: 

verification that no conflict exists between the contracts 
of the different suppliers, 

verification that the contracts reflect the agreements 
that have been reached. 

6 . 4 Implications 

Matters which should be considered are the: 

risks involved in entering into a contract, 
insurance responsibilities including fidelity bonds, 
experience in other authorities, 

advice from user groups and other external bodies. 

6.5 Approval 

Matters which should be considered are the: 

approvals sought of, and given to the agreed contracts, 
formal statement of what is being accepted, 

statement of the overall contract price and any detail 
relating to it, 

advice on the contact point in the authority. 
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7 . 



OBLIGATIONS OF SUPPLIERS 



This is concerned with the: 
delivery schedules, 
deliveries made, 
acceptance testing, 
payment of supplier invoices , 
maintenance of equipment and services. 

Audit evidence should be sought in internal audit reports , 



supplier correspondence, minutes of meetings with suppliers, delivery 
notes, acceptance certifications, invoices, support staff timesheets and 
test plan results. 



Matters which should be considered are the: 
delivery schedule for: 

computer site construction supplies, 
environmental equipment. 

completion schedule for the preparation and commissioning 
of the computer site, 
delivery schedule for the: 
computer equipment, 
system software, 
application software, 
support staff. 



Matters which should be considered are the: 

documentation of changes made to the order before delivery, 
substitution of alternative equipment or services by the 
supplier , 



7.1 



Schedules 



7.2 



Delivery 
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specification of changes made to the authority’s require- 
ments s 

specification of changes made to the suppliers' equipment, 
software or services. 

7 . 3 Acceptance testing 

Matters which should be considered are the: 
commissioning procedure for the: 
computer hardware , 
systems software. 

repetition of the evaluations carried out during 
selection, 

system testing procedure for the applications software, 
probationary period for the support staff, 
removal schedule for old equipment and services, 
procedure for controlling the ongoing implementation, 
certification that the products perform: 
to their standard specification, 
as required. 

7 .4 Payment of invoices 

Matters which should be considered are the: 

certification that charges are as shown on the order, 
certification of changes to price between the date of the 
order and the date of delivery, 

certification of timesheets where staff services have 
been supplied, 

certification that work has been carried out. 
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7.5 



Maintenance 



Matters which should be considered are the: 
honouring of warranty agreements , 

schedules for equipment preventive maintenance and the 
occurrence of corrective maintenance, 
plans for documentation updates and the occurrence of 
documentation errors, 

plans for software enhancement and the occurrence of 
faults , 

schedules for implementation support and the occurrence 
of staffing changes. 
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8 . 



POST IMPLEMENTATION REVIEW 



This is concerned with the: 

objectives that the acquisition set out to meet, 
extent to which these objectives have been accomplished. 
Audit evidence should be sought in management correspondence, 
internal audit reports, reports to committees, committee minutes, and 
committee terms of reference. 

8. 1 Qbj ectives 

Matters which should be considered are the: 

extent to which the objectives at the outset remained 
unchanged during the acquisition process. 

8.2 Accomplishments 

Matters which should be considered are the: 
extent to which: 

the computer facilities are operating in accordance 
with the agreed specifications, 

the user departments are satisfied with the performance 
of the computer facilities, 

the requests for modification, enhancement or amendment 
to the acquisition are valid and each has a priority 
for implementation relative to the others, 
the planned system timings are realistic, 
the disruption caused by poor computer facility 
performance affects staff levels, overtime working 
and costs, 

the planned cost savings are achieved, 
the planned cost budget is met, 



Printed image digitised by the University of Southampton Library Digitisation Unit 



the shortfall in cost savings or overrun in cost 
budget can be explained, 

the planned benefits other than costs are met, 
the shortfall in planned benefits can be explained, 
the acquisition realised unplanned cost savings and 
benefits , 

the control procedures for operating the acquired 
facilities are adequate. 
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Appendix I 



HARDWARE SPECIFICATION CHECKLIST 
The auditor can expect the specification documentation to deal 
with the following matters. 

1 • Functional requirements 

The specification of: 



what work the computer is to perform, 
the expected capability of the: 
central processor, 
communications facilities, 
peripherals, 
data capture facilities. 

Service requirements 
The specification of: 

when the work is to be performed, 
the requirement for: 
accuracy, 

operational availability, 
reliability, 

- performance, 

standby arrangements. 

Storage requirements 
The specification of: 

what type of storage is required, 

the access required to this storage and how information 
will be input and output. 

Future requirements 
The specification of: 

the allowance that is required for growth. 
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SYSTEM SOFTWARE SPECIFICATION CHECKLIST 



The auditor can expect the specification documentation to deal 



with the following matters. 



1 



Functional requirements 



The specification of: 

what functions the system software is to perform, 
the expected capability of the: 



operating system, 

communications software, 

data base software, 

program development facilities, 

timesharing services, 

word processing facilities, 

conversion and emulation facilities. 



The specification of: 

when the software is to be run, 
the requirement for: 
accuracy, 

- operational availability, 
reliability, 
performance. 



The specification of: 

what information is to be maintained in the system software 
the access required to this information and how it will 
be input and output. 



2 . 



Service requirements 



3 . 



Information requirements 
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4 . Pu.tu.re requirements 

The specification of: 

the allowance that is required for growth. 
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Appendix III 



APPLICATION SOFTWARE SPECIFICATION CHECKLIST 
The auditor can expect the specification documentation to deal 
with the following matters. 

1 . F unctional requirements 
The specification of: 

what functions the application software is to perform, 
the expected capability of packaged software. 

2 . Service requirements 
The specification of: 

when the application software is to be run, 
the requirement for: 
accuracy, 

operational availability, 

reliability, 

performance. 

3 . Informatio n re quire ments 
The specification of: 

what user information is to be maintained by the application 
software, 

the access required to this information and how it will 
be input and output. 

4 . Fu ture requirements 
The specification of: 

- the allowance that is required for growth. 
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COMPUTER SITE SPECIFICATION CHECKLIST 

The auditor can expect the specification documentation to deal 
with the following matters. 

1 • Functional requirements 

The specification of: 

- what floor area is required, 

- the expected capacity of the: 

computer room, 
data preparation area, 
computer library, 
off-line area, 
telecommunications area, 
engineering area, 
stores area , 

off-site security storage, 
general offices. 

2 . Service requirement s 

The specification of: 

when the areas are required, 

- the environmental need for: 

- heating, 

- lighting, 

- power, 

- air conditioning, 
security. 
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3 . Information requirements 
The specification of: 

what consumables and records are to be stored, 

the access required to these stores and how they will be 

transferred in and out of the computer area, 

4. Future requirements 
The specification of; 

the allowance that is required for growth. 
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SUPPORT SPECIFICATION CHECKLIST 



The auditor can expect the specification documentation to deal 



with the following matters. 



1 . 



Functional requirements 



The specification of; 

- what conversion work the support staff will be required 
to perform, 

- the expected capability of the: 



engineers , 

system software support, 
application software support, 
supplier’s project management, 
supplier's training organisation. 



The specification of: 

when the support staff are required, 
- the need for; 

* experience, 

* availability, 
reliability, 

- skill. 



The specification of; 

- what documentation and training is to be provided, 

- the access required to this information before and after 
delivery. 



2 . 



Service requirements 



3 . 



Info rmation requirements 
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4. Future requirements 

The specification of: 

the ongoing support that will be required after installation 
of the equipment and/or software. 
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HARDWARE INFORMATION CHECKLIST 

The auditor can expect the supplier's proposal documentation 
to define what equipment is available and which items of this equipment 
are needed by the authority. In so doing the proposal documentation 
should deal with the following matters. 

1 . General 

The definition for each item of equipment of its: 
physical characteristics, 

- environmental requirements , 

installation and commissioning characteristics, 
interfaces and compatibility, 

reliability, operational availability and performance, 
maintenance requirements, 
consumables requirement. 

2. Supplier information 

The specification of the: 

origins and credibility of the supplier, 
financial strength of the supplier, 

* number of employees that the supplier has in the U.K, , 
level of support that is available, 
user groups that are active, 

similar installations that are operational in the U.K. , 

equipment delivery lead time, 

location where the equipment is manufactured. 
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3. Central processor 
The definition of: 

maximum and minimum memory configurations , 
memory upgrade increments, 
expected memory usage. 

4 . Communications 
The definition of: 

transmission circuit capability, including: 
leased lines, 
dial-up lines, 

- modems . 

polling technique as asynchronous or synchronous, 
minimum and maximum configurations of terminals and 
lines , 

local and remote capability, including: 
remote batch processing, 
on-line processing. 

4 . 1 Terminals 

The definition of: 

screen capability, including: 
colour, 
size, 

refresh rate. 

keyboard capability, including: 

function keys for software programming, 
function keys for word processing. 
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intelligence capability, including: 
local processing, 
data communications . 

5 . Peripherals 

The definition of: 

disc storage capability, including: 

- maximum and minimum configurations, 
expected disc usage. 

- magnetic tape capability, including: 

maximum and minimum configurations, 
expected tape usage, 
printer capability, including: 

maximum and minimum configurations, 
expected printer usage. 

the capability of other peripherals that may be attached 
to the central processor. 

6 . Dat a cap ture 

The definition of: 

~ interface requirements between the central processor and 
data capture equipment, including: 

- key to disc, 

point of sale terminals, 
other data capture devices. 
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SYSTEM SOFTWARE INFORMATION CHECKLIST 
The auditor can expect the supplier’s proposal documentation 
to define what system software is available and which items of this 
software are needed by the authority. In so doing the proposal documen- 
tation should deal with the following matters. 

1 . General 

The definition for each item of software of its: 
hardware resource requirements, 
installation and commissioning characteristics, 
mandatory and optional versions , 
portability across different types of hardware, 
maintenance requirements, including: 
frequency of updates , 

personnel and computer time resources needed to 
maintain the software, 

- planned enhancements , 

source of maintenance expertise, 
development history, including: 
origins of the software, 
provenness. 

available documentation. 

2 . Supplier information 

The definition of the: 

origins and credibility of the supplier, 
financial strength of the supplier, 

number of employees that the supplier has in the U.K., 
level of support that is available, 
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user groups that are active, 

rights that the supplier has to licence or sell the 
software , 

similar installations that are operational in the U.K. , 
software delivery lead time. 

3 . Operating system 

The definition of: 

functions performed by utilities , 
facilities for job: 
scheduling, 
control, 
streaming, 
accounting. 

facilities for monitoring: 
performance, 
throughput . 
procedures for: 

fault logging and reporting, 
voluntary close down of the system, 
recovery, 
facilities for: 

multi-programming, 
multi-user access to files, 
multi-user use of peripherals, 
output spooling. 
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4. Communications software 

The definition of: 

communications protocols, 

high level transaction processing programming languages, 
4. 1 Terminals 

The definition of: 

screen format handling software. 

5 . Database software 
The definition of: 

the types of data structure that can be constructed, 
database controls over: 
privacy, 
security. 

data dictionary facilities, 
report writer facilities, 
database restructuring facilities. 

6. Program development 
The definition of: 

programming languages and versions, 
program development aids, 

7 . Timesharing services 
The definition of: 

- user and terminal identity controls. 

8 . Word processing 
The definition of: 

facilities for text: 
entry, 
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display, 

storage, 

searching, 

editing, 

composition, 

printing. 

9 . Conversion and emulation 

The definition of: 

automatic program source code conversion aids, 
operational constraints on the use of emulation. 
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APPLICATION SOFTWARE INFORMATION CHECKLIST 
The auditor can expect the supplier’s proposal documentation 
to define what application software is available and which items of this 
software meet the authority's needs. In so doing the proposal documen- 
tation should deal with the following matters . 

1 . General 

The definition for each application system of its: 
hardware resource requirements, 
installation and commissioning characteristics, 
mandatory and optional facilities, 
portability across different types of hardware, 
maintenance requirements, including: 
frequency of update, 
planned enhancements , 

personnel and computer time resources needed to 
maintain the software, 
source of maintenance expertise, 
development history, including: 
origins of the software, 
provenness, 

available documentation. 

2 . Supplier information 
The definition of the: 

origins and credibility of the supplier, 
financial strength of the supplier, 

number of employees that the supplier has in the U.K. , 
level of support that is available, 
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user groups that are active, 

- rights that the supplier has to licence or sell the 
software , 

similar installations that are operational in the U.K. , 
software delivery lead time. 

3 . Application information 

The definition of: 

user requirements that are met, 

work that is involved in changing the system to meet user 
requirements . 
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COMPUTER SITE INFORMATION CHECKLIST 
The auditor can expect the supplier* s proposal documentation 
to deal with the following matters . 

1 . General 

The definition of the: 
programme of work, 
materials to be used, 
service equipment to be installed. 

2. Supplier information 
The definition of the: 

origins and credibility of the supplier, 
financial strength of the supplier, 
level of support that is available, 

other site preparations that the supplier has success- 
fully completed, 
equipment delivery lead time. 
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SUPPORT INFORMATION CHECKLIST 

The auditor can expect the supplier's proposal documentation 
to define what support is available and which aspects of this support 
are needed by the authority. In so doing the proposal documentation 
should deal with the following matters . 

1 . General 

The definition of the: 
support, for: 

conversion, 
engineering, 
system software, 
application software, 
project management, 
training. 

pre and post installation support, 
support staff curriculum vitae. 

2. Supplier information 

The definition of the: 

origins and credibility of the supplier, 
financial strength of the supplier, 

number of employees that the supplier has in the U.K. , 
staff that are available, 

similar installations where staff are operating in a 

support role in the U.K. , 

lead times for obtaining staff, 

support staff's home location. 
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RENTAL INFORMATION CHECKLIST 

The auditor can. expect the following matters to be defined: 
monthly payment , 
price protection provisions, 
contract term, 
contract start date, 
first payment date, 
cancellation provisions, 
deposit, 

maintenance charges: 
per month, 
per call. 

charges for extra use of equipment beyond any stipulated 

number of hours per month, 

options to convert to purchase, including: 

which rentals that have been paid may be offset 
against the purchase price, 
the maximum amount that may be offset, 
the latest date for conversion, 
charges for pre-installation computer time: 
on the supplier's facilities, 
on other sites, 

in excess of any free .allocation, 
support costs: 
per hour, 

per hour in excess of any predetermined limit. 
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PURCHASE INFORMATION CHECKLIST 
The auditor can expect the following matters to be defined 
purchase price, 
payment date , 
estimated resale value, 
estimated trade-in value, 
deposit, 

maintenance charges: 
per month, 
per call. 

price protection provisions, 
charges for pre-installation computer time: 
on the supplier’s facilities, 
on other sites, 

in excess of any free allocation, 
support costs: 
per hour, 

per hour in excess of any predetermined limits. 
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LEASE INFORMATION CHECKLIST 

The auditor can expect the following matters to be defined: 
monthly payment, 
price protection provisions, 
contract term, 
contract start date, 
first payment date, 
cancellation provisions, 
deposit, 

who at the end of the lease owns the: 
hardware, 
systems software, 
application software. 

- provisions for conversion to purchase during the lease, 
maintenance charges: 

per month, 
per call. 

- charges for extra use of equipment beyond any stipulated 

number of hours per month, 

residual value at the end of the lease, 

- charges for pre-installation computer time. 

on the supplier’s facilities, 
on other sites, 

- in excess of any free allocation, 
support costs: 
per hour, 

per hour in excess of any predetermined limit. 
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STANDARD CHECKS ON CONTRACT TERMS AND CONDITIONS 
The auditor can expect the contract documentation to deal with 
the following matters . 

1 . Description of the equipment, software or services 

The definition of: 

what is to be supplied, 

the specification that defines its capabilities, 
agreements about: 

changes that may be made to the order before delivery, 
the substitution of alternative equipment or services 
to that which was ordered. 

2 . Delivery and timescale 
The definition of: 

when delivery is expected, 

agreements about the penalty for late delivery. 

3 . Acceptance 

The definition of: 

what procedure will be followed to determine the acceptability 
of that which has been supplied to the authority , 
the link between acceptance and payment. 

4. Charges 

The definition of: 
the charges , 

agreements about price changes between the date of order 
and the date of delivery, 
the method of payment. 
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5. 



Rights and obligations 



The definition of: 

what redress the authority has in cases where that which 
is supplied is not fit for its intended purpose, 
the redress that the supplier has in cases where the 
authority misuses the equipment, software or services, 
agreements about any time limit for legal action. 



The definition of: 

what warranty is provided, 
the maintenance charges, 

the charges for support in addition to that specified, 
agreements about: 



the obligation of the supplier to maintain his 
equipment, software or services for a specified 
future period, 

the authority's obligation to obtain maintenance 
from the supplier, 

cost escalation, incorporating the period of notice 
for increases and whether the charges are exclusive 
of VAT. 



The definition of: 

agreements about termination of the contract, 

the period of notice that is to be given by either party. 



6 . 



Maintenance 



7. 



Termination 
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8. Other matters 

The definition of agreements about: 

the supplier’s indemnity of the authority, 
force majeure to protect both parties from the 
consequences of events outside their control, 
the authority’s indemnity of the contractor, 
the assignment of the supplier’s contract to sub- 
contractors , 

the law to be applied in interpreting the contracts, 
provision for the appointment of an arbiter in the event 
of a dispute, 

the rights of either party to claim compensation. 



Printed image digitised by the University of Southampton Library Digitisation Unit 



Appendix XV 



PARTICULAR CHECKS ON CONTRACTS FOR HARDWARE 
The auditor can expect the contract documentation to define: 

the type and number of manuals and other documentation to 
be supplied with the equipment, 

how much training and consultancy in the use of the 
equipment is to be provided and when it is to be given, 
the provisions for additional training and consultancy, 
who is responsible for system integration and checkout, 
what constitutes delivery of the equipment, 
agreements about protecting the authority and/or the 
supplier in the event that the proposed equipment or 
services interferes with the performance of equipment or 
services from another supplier, 

the arrangements for updating the documentation. 



Printed image digitised by the University of Southampton Library Digitisation Unit 



Appendix XVI 
Page 1 



PARTICULAR CHECKS ON CONTRACTS FOR SOFTWARE 
AND SOFTWARE LICENCES 

The auditor can expect the contract documentation to define: 

the programming language in which the software is written, 
the functions of the programs , 

whether the code is supplied in source or object form, 
which versions of the programs are to be supplied, 
the make and location of the computer hardware on which 
the programs are to run, 

the version of the operating system under which the 
programs must run, 

the maximum and/or minimum configuration on which the 
programs may be used, 

the type and number of manuals and other documentation to 
be supplied with the programs, 

the input forms that are supplied with the programs, 

the media on which the programs will be supplied, 

the amount of machine time that will be needed for installation, 

how much training and consultancy in the use of the 

programs is to be provided and when it is to be given, 

- the provisions for additional training and consultancy , 
the operation of the licence during hardware changes, 
the operation of the licence during the use of standby 
computer facilities, 

what documentation the supplier will accept as evidence 
of errors in the software, 
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the ownership of patent, copyright or other industrial or 
intellectual right that the supplier has to the software, 
the rights that the supplier has to licence the software, 
agreements about: 

restrictions on the copying of the software and/or 
the documentation, 

the supply of the object version of the software, 
where the supplier should be prepared to lodge with 
a third party and keep updated a source version to 
protect the authority in the event of the supplier 
going into liquidation or failing to provide main- 
tenance at reasonable charges, 

the supply of the source version of the software, 
where the supplier should be prepared to let the 
authority carry on using it in the event of the 
supplier’s liquidation, notwithstanding any rights 
the receiver or liquidator may have. 



termination of the licence agreement, whereupon the 
authority should be prepared to return the programs 
and documentation within a specific period or destroy 
them and provide certification to that effect to the 
supplier, 

access to the software by the authority’s own staff 
or contract staff. 
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which updates produced by the supplier are to be 
made available, under what conditions and how the 
authority’s rights will be prejudiced if they are 
not installed, 

what rights the authority has to modify, enhance or 
upgrade the software and the terms, if any, on which 
such amendments would be made available to the 
supplier . 
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PARTICULAR CHECKS ON CONTRACTS FOR 
COMPUTER SITE CONSTRUCTION 

The auditor can expect the contract documentation to define: 
the agreed programme of work, 

the drawings that define the work to he completed, 
agreements about: 

variations to the programme of work, 

- circumstances where contract extensions are necessary 
because the appointed date of completion has passed 
and work is still outstanding, 

responsibilities for ensuring worker's compliance 
with safety precautions, 

responsibilities for checking the correctness and 
safety of electrical and mechanical connections, 
the use of good quality materials, techniques and 
standards , 

the rights of contractors to have access to the 
authority premises. 
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PARTICULAR CHECKS ON CONTRACTS FOR STAFF 
The auditor can expect the contract documentation to define: 
what work is to be carried out, 
how many people will be supplied, 
the charges for: 
people, 

travelling and subsistence, 

supervision, 

office accommodation, 

typing and copying, 

computer time , 

special software. 

the documentation standards that the contract staff will 
use , 

who owns the software and/or documentation at the end of 
the contract, 

who has the rights to copy the software and/or the documen- 
tation, 

what redress the authority has in cases of delay caused 
by negligence or unsuitable staff on the part of the 
supplier , 

what charges the supplier can reasonably make in cases of 
delay caused by lack of information, lack of authority 
resources or abortive work due to changes in the specification 



which prevent the documentation, system or programs being 
completed on time, 
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agreements about: 

replacement of the support staff in the event of 
their departure to a new employer, 

restrictions on either party to prevent the poaching 
of each other's staff. 
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PARTICULAR CHECKS ON JOINT AUTHORITY AGREEMENTS 
The auditor can expect the agreements to define: 
who owns the hardware, 
who owns the software, 
who owns the data , 

how payments are to be made to the suppliers, 

how funds are to he made available by the participating 

authorities , 

who is to provide the computer site, 
how operating expenses are to be charged, 
who manages the installation, 

who has responsibility for signing contracts and paying 
bills, 

the method of charging for computer services that are 
given to third party authorities, 

the arrangements for termination of and withdrawal from 
the agreement. 
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